dotnet/wpf · error · Win32Exception

new Win32Exception()

Error message

new Win32Exception()

What it means

WinEventWrap.StartListening installs WinEvent hooks via SetWinEventHook for each event id; if SetWinEventHook returns IntPtr.Zero the wrapper stops listening and throws Win32Exception with the last Win32 error. This means Windows refused to create the event hook, so the UI Automation client cannot receive those window events.

Solutions

  1. Ensure the process runs in an interactive desktop session (not a service with no UI) and has adequate privileges
  2. Catch Win32Exception around AddAutomationEventHandler/WindowPattern event registration and surface the native error code (ex.NativeErrorCode) for diagnosis
  3. Avoid excessive numbers of event listeners in one process; consolidate listeners via ClientEventManager
  4. Check global hook limits and other software (AV/security tools) that may block SetWinEventHook

Example fix

// before
Automation.AddAutomationEventHandler(WindowPattern.WindowOpenedEvent, desktop, TreeScope.Children, handler);
// after
try
{
    Automation.AddAutomationEventHandler(WindowPattern.WindowOpenedEvent, desktop, TreeScope.Children, handler);
}
catch (Win32Exception ex)
{
    log.Error($"WinEvent hook failed (Win32 {ex.NativeErrorCode})");
}
Defensive patterns

Strategy: try-catch

Try / catch

try { Automation.AddAutomationEventHandler(...); }
catch (Win32Exception ex) { log.Error($"Hook failed, Win32 error {ex.NativeErrorCode}"); }

Prevention

When it happens

Trigger: ClientEventManager starting event listening (EventListener/EventWrap creation) where UnsafeNativeMethods.SetWinEventHook returns IntPtr.Zero for one of the requested event ids, e.g. WINEVENT_OUTOFCONTEXT hooks for WindowOpen/WindowClose events.

Common situations: Running in restricted sessions (services, session 0) without an interactive desktop; insufficient privileges to hook events in other sessions; too many hooks already installed by the process; hooks failing under elevated/integrity-level mismatches.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/f4324aaf98421378. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/UIAutomation/UIAutomationClient/MS/Internal/Automation/WinEventWrap.cs:113

            return listIsEmpty;
        }

        // install WinEvent hook and start getting the callback.
        internal void StartListening()
        {
            _fBusy = true;

            int i = 0;
            foreach (int eventId in _eventIds)
            {
                // There is no indication in the Windows SDK documentation that SetWinEventHook()
                // will set an error to be retrieved with GetLastError.
                _hHooks[i] = UnsafeNativeMethods.SetWinEventHook(eventId, eventId, IntPtr.Zero, _winEventProc, 0, 0, _fFlags);
                if (_hHooks[i] == IntPtr.Zero)
                {
                    StopListening();
                    throw new Win32Exception();
                }
                i++;
            }
            _fBusy = false;
        }

        internal void StopListening()
        {
            // ASSUMPTION: Before StopListening is called, all callback delegates have been removed
            // so that any events received while hooks are being removed become noops (since there's
            // no handlers for them to call).
            _fBusy = true;

            for (int i=0;i<_hHooks.Length;i++)
            {
                if (_hHooks[i] != IntPtr.Zero)
                {
                    // There is no indication in the Windows SDK documentation that UnhookWinEvent()

View on GitHub (pinned to 81131a70a4)